import java.util.ArrayList;
import java.util.List;


public class SOEN_321_Project {

	public static void main(String[] args) {		
		
//-------------------------------------------------------------------------------------------------
		// DO THIS ONCE TO GET SERIALIZED FILE		
		//Get Alerts from DB		
		//AlertRepository ar = new AlertRepository();
		//List<Alert> alertList = ar.getAllAlerts();	
		
		//Serialize Alerts (FIX FOR GRAPH VIZ)
		//logReader.setAlertList(alertList);
		//logReader.saveAlertLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alertLog.ser");
		
		//Get Hosts from DB
	   // List<Host> hostList = ar.getHostList();
		
		//Serialize Hosts
		//logReader.setHostList(hostList);
		//logReader.saveHostLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\hostLog.ser");
//-------------------------------------------------------------------------------------------------		

		LogReader logReader = new LogReader("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alert_parse.txt");
		
		//Load alerts from serialized file
		logReader.loadAlertLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alertLog.ser");
		List<Alert> alertList = logReader.getAlertList();
				
		//Load Hosts from serialized file
		logReader.loadHostLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\hostLog.ser");
		List<Host> hostList = logReader.getHostList();
		
		//List<Host> hostList = generateHostList(alertList);
		//List<Host> hostList = new LinkedList<Host>();
		
		for (Alert alert : alertList)
		{
			//remove next line testing for each host
			//if(alert.getDestination_ip().equalsIgnoreCase("172.16.112.100")){
			
			
				//Have to do this sequentially unless we change LinkedList to Dictionary<String IP, Host newHost>
				for (Host h : hostList)
				{
					//Get proper parent alert name based on AlertID (using switch)
					String parentAlertName = "";
					ArrayList<String> parentAlerts = new ArrayList<String>();
					
					if (h.getIP().equalsIgnoreCase(alert.getDestination_ip()))
					{			
						
						switch (alert.getAlert_id()) {
				            case 384:  //parentAlertName = ""; //Has no parent
				            	parentAlerts.add("");
				                     break;

				            case 408:  

				                    break;
				            case 585: 
				            		//parentAlertName = "ICMP Echo Reply";
				            	parentAlerts.add("ICMP Echo Reply");
				            	//parentAlerts.add("ICMP PING");
				            		break; //"ICMP PING";
				            case 1957:  //parentAlertName = "RPC portmap sadmind request UDP";
				            	parentAlerts.add("RPC portmap sadmind request UDP");
				                     break;
				            case 402:  //parentAlertName = "ICMP PING";
				            	//parentAlerts.add("ICMP PING");
				            	parentAlerts.add("RPC sadmind UDP PING");
				                     break;
				            case 2256:  //parentAlertName = "RPC sadmind UDP PING";
				            	parentAlerts.add("RPC sadmind UDP PING");
				                     break;
				            case 1911:  //parentAlertName = "RPC sadmind UDP PING";
				            	parentAlerts.add("RPC sadmind UDP PING");
				                     break;
				            case 716:  //parentAlertName = "INFO TELNET Bad Login"; //Has no parent
				            	parentAlerts.add("INFO TELNET Bad Login");
				            	parentAlerts.add("INFO TELNET login incorrect");
				                     break;
				            case 718:  //parentAlertName = "ICMP Echo Reply"; //INFO TELNET access
				            	parentAlerts.add("ICMP Echo Reply");
				            	//parentAlerts.add("ICMP PING");
				                     break;
				            case 1251: //parentAlertName = "INFO TELNET login incorrect";
				            	parentAlerts.add("ICMP Echo Reply");
				            	//parentAlerts.add("INFO TELNET login incorrect");
				                     break;
				            case 610: //parentAlertName = "RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"; //Has no parent
				            	parentAlerts.add("RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt");
				                     break;
				            case 528: //parentAlertName = ""; //Can also be "RPC portmap sadmind request UDP"
				            	parentAlerts.add("");
				                     break;
				            case 1421: //parentAlertName = "ICMP Echo Reply"; //Maybe, not sure about this
				            	parentAlerts.add("ICMP Echo Reply");
		                    		 break;
				            case 524: //parentAlertName = "";
				            	parentAlerts.add("");
		                    		 break;
				            default: continue; //Not an alert we care about, go to next
						}
						
						
						//should be changed
						//this gets the 384 or 408 alerts (ICMP ping) and puts it as root of the alertTree
						if(alert.getAlert_id() == 384){
							h.firstAlert(alert);
						}else{
							//h.addAlertTo(alert, parentAlertName);
							h.addMultAlertTo(alert, parentAlerts);
						}
					}
					else if(h.getIP().equalsIgnoreCase(alert.getSource_ip())&&(alert.getAlert_id()== 408))
					{
						parentAlertName = "ICMP PING";				
						parentAlerts.add("ICMP PING");
						
						if(h.isFirstAlert()){
							h.firstAlert(alert);
						}else{
							//h.addAlertTo(alert, parentAlertName);
							h.addMultAlertTo(alert, parentAlerts);
						}
					}
				}
			//}
		}
		
		
		System.out.println("digraph G { ");	
		
		for (Host h : hostList)
		{
			//System.out.println(h.getIP());
			h.printHostAlertTree();
		}
		

		System.out.println("}");	
	}

/*--------------------------------------------------------------------------------------------------------------
The following line is for use if you want to parse the Alert objects directly from the parsed Snort dump file
 *Not to be used with current implementation (MySQL database)
 
 LogReader logReader = new LogReader("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alert_parse.txt");	
 logReader.readLog();
 
 Serializes Alerts to a file so we don't have to parse them each time
 logReader.saveLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alertLog.ser");
 
 Read the alerts that we serialized to a file
 logReader.loadLog("C:\\Eclipse Projects\\SOEN_321_Project\\src\\alertLog.ser");
 
 ---------------------------------------------------------------------------------------------------------------
	
	*TO TEST Repository*
	
	AlertRepository artest = new AlertRepository();
	
//Testing AlertRepository getting an alert by event_id

	Alert alertbyid = artest.getAlertByEventID(99);
	System.out.println("Alert with event_id 99");
	System.out.println(alertbyid.toString());

//Testing AlertRepository getting alerts for an ip, sorted by time and milli_secs

	List<Alert> alerts_by_ip = artest.getAlertsByIP("172.16.113.50");
	System.out.println("Alerts with ip 172.16.113.50");
	for (Alert a : alerts_by_ip) 
		System.out.println(a.toString());

//Testing AlerRepository, getting all unique destinatin_ip, Host List
 
	List<Host> host_list = artest.getHostList();
	System.out.println("Size of host_list: " + host_list.size()); //should be 55
			
//Test for getallalerts
 * 
	List<Alert> alerts_all = artest.getAllAlerts();
	System.out.println("All alerts");
	for (Alert a : alerts_all) 
		System.out.println(a.toString());

--------------------------------------------------------------------------------------------------------------
*/
}
